MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0
SHA3-384 hash: e2617c0a4f072fb267844553440dbd4752ee462c88e75c1360859e9ce5b9c5f3465d8360458d806973adf96f313ff77d
SHA1 hash: 8beda4153d46e4ba35ea1c7497018903c664127c
MD5 hash: e077d17b78bc51fb674d283ae98ec5a8
humanhash: chicken-ten-summer-william
File name:Company-Profile.vbs
Download: download sample
File size:358'344 bytes
First seen:2023-06-27 06:48:57 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 3072:FRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXQh5n5G5XNsni+zcg4K20MxzaktI1vsV:8l2ZnP5Mxzakp
Threatray 22 similar samples on MalwareBazaar
TLSH T19C749B0263FA0108F2F36B49AA7645784B37BEA6697DC55C418C290E0FF7E448D65BB3
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter abuse_ch
Tags:vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/403129/
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-IG.27461.11949.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/649a865ef20d1a731dc25531/reports/6d061520-10a0-4cb6-882f-964861c32db7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0
Result
Verdict:
UNKNOWN
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261856
Signature
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 894909 Sample: Company-Profile.vbs Startdate: 27/06/2023 Architecture: WINDOWS Score: 100 56 Snort IDS alert for network traffic 2->56 58 Multi AV Scanner detection for domain / URL 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 3 other signatures 2->62 8 wscript.exe 1 2->8         started        11 wscript.exe 1 2->11         started        process3 signatures4 66 VBScript performs obfuscated calls to suspicious functions 8->66 68 Suspicious powershell command line found 8->68 70 Wscript starts Powershell (via cmd or directly) 8->70 13 cmd.exe 1 8->13         started        16 powershell.exe 7 8->16         started        18 cmd.exe 1 11->18         started        20 powershell.exe 11->20         started        process5 signatures6 78 Wscript starts Powershell (via cmd or directly) 13->78 80 Uses ping.exe to sleep 13->80 82 Uses ping.exe to check the status of other devices and networks 13->82 22 cmd.exe 1 13->22         started        25 PING.EXE 1 13->25         started        28 conhost.exe 13->28         started        84 Suspicious powershell command line found 16->84 30 powershell.exe 14 16 16->30         started        32 conhost.exe 16->32         started        34 cmd.exe 1 18->34         started        40 2 other processes 18->40 36 powershell.exe 20->36         started        38 conhost.exe 20->38         started        process7 dnsIp8 64 Wscript starts Powershell (via cmd or directly) 22->64 42 powershell.exe 9 22->42         started        50 127.0.0.1 unknown unknown 25->50 52 ftpserver.winconnection.net 177.191.228.117, 49699, 49701, 80 ALGARTELECOMSABR Brazil 30->52 54 yorkrefrigerent.md 195.178.106.125, 443, 49700, 49702 TOPHOST-MD-ASRMoldovaChisinauParis18ARO Romania 30->54 46 powershell.exe 9 34->46         started        signatures9 process10 file11 48 C:\Users\user\AppData\Roaming\...\um.vbs, Unicode 42->48 dropped 72 Suspicious powershell command line found 42->72 74 Drops VBS files to the startup folder 42->74 76 Found suspicious powershell code related to unpacking or dynamic code loading 42->76 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0/
Threat name:
Script-WScript.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-06-27 06:49:05 UTC
File Type:
Text (VBS)
AV detection:
2 of 37 (5.41%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=55etbnnqumfbzret6s37ol6k3tiqtuqzk3jkz3loqxsmn5pgt6ya._file
Verdict:
malicious
Similar samples:
2184033d7ec56ba7ace3dcb48d10e47874a638d8a7c01e0ed321c79d2e9e576f
3e71e3cd25afc388b26a1f2c24b3dc9810476fd015fffca1da584b4f98438d2f
5a46c33cf8a11a1c4653c344b2559444343a740a7ea479bd2f2d1a51fc7cd9ae
63ff2048431b0b07082efac82b0df98fc58b00af04df325ea8a50b81c0110a95
7474c59e2ced7b554bc03a190b33690f640a8f415b38fe21e2caa0a7a33215c9
8cfab1a4c573103b5b39aed0c2cb8fbcd76d246d7bc106fd0ad1fa6adeff91b9
8e7fbeb2dd4fecea39d5194595357509c3d9a0bdfd5d8f962815f97090e9c831
91bedde298120f2112051018910a77a8672687917722e9a4aba692ec312bf4b2
abe25695b67fcf9e07c535f4f8664a2828fbef735821337603a451475b7976da
b01cb5bcdee9a635e42e6bec14d6cd09cc24749ab76c8e23d8a52185d9267897
+ 12 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230627-hlchsaec4v/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://ftpserver.winconnection.net/E/e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/403129/

Comments